1. Overview
ZapAPI ("we", "us", "our") provides a Lightning Network payments platform: APIs for invoices, webhooks, Lightning addresses, payment links, and related tools. This policy explains what data we collect, why, how we protect it, and the rights you have over it.
The short version: we are non-custodial. We never hold, control, or have access to your Bitcoin or your private keys. Payment data flows between your customers and Lightning infrastructure that you control.
2. Data we collect
2.1 Account data
- Email address, name, and password hash (never plaintext)
- Account settings, team memberships, and role assignments
- Billing information for paid plans (processed by our payment processor — we never see full card numbers)
2.2 Integration data
- API keys — hashed at rest; only the prefix is ever displayed
- Provider credentials (e.g. LNbits URL/key, NWC connection strings) — encrypted at rest with scoped access
- Webhook endpoints and secrets — URLs you register and their HMAC signing secrets
2.3 Operational data
- Payment metadata — invoice amounts, memos, payment hashes, settlement status, and any custom metadata you attach. This is required to operate the service.
- Usage logs — API request logs (endpoint, status, latency, IP) retained per your plan's log window
- Webhook delivery logs — attempt counts, response codes, and payloads for debugging
2.4 What we deliberately do NOT collect
- Private keys, seed phrases, or macaroons with withdrawal rights
- Your customers' identity data (payers pay invoices directly; we never see their wallets)
- On-chain UTXOs or channel state from your node
3. How we use your data
- Provide, operate, and secure the platform (authentication, invoice routing, webhook delivery)
- Bill you for paid plans and enforce usage limits
- Send transactional email (receipts, security alerts, webhook failure notices)
- Improve the product through aggregated, de-identified usage analytics
- Comply with legal obligations (tax, fraud prevention, lawful requests)
We do not sell your data, and we do not use payment metadata for advertising.
4. Data sharing
We share data only with the sub-processors required to run the service:
- Hosting & database — Vercel and our Postgres provider (data encrypted in transit and at rest)
- Email delivery — transactional email provider for receipts and alerts
- Billing processor — for paid plan invoicing
We may disclose data if legally compelled (valid court order), and — where legally permitted — we will notify you first.
5. Data retention
- Account data — kept while your account is active; deleted within 30 days of account deletion
- API request logs — 7 days (Free), 30 days (Pro), 90 days (Business)
- Payment records — retained for accounting/tax compliance as required by law
- Webhook delivery logs — same window as API logs
6. Security
- TLS everywhere; HSTS enforced
- API keys stored as one-way hashes
- Provider credentials encrypted at rest
- Tenant isolation between customer projects
- Role-based access control for team features
- HMAC-signed webhooks so receivers can verify authenticity
No system is perfectly secure, but our non-custodial design bounds the worst case: even a full platform compromise cannot move your Bitcoin, because we never hold keys that can spend it.
7. Cookies & tracking
We use a small set of strictly necessary cookies/local storage for authentication sessions and preferences (e.g. theme). We do not use third-party advertising trackers.
8. Your rights
Depending on your jurisdiction (GDPR, CCPA, and similar), you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Export your data in a portable format
- Object to or restrict certain processing
To exercise any of these, email privacy@zapapi.app from your account email. We respond within 30 days.
9. International transfers
Our infrastructure may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.
10. Children
ZapAPI is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
If we make material changes, we will notify you by email and update the "last updated" date above. Continued use after the effective date constitutes acceptance.
12. Contact
Questions about this policy or your data? Email privacy@zapapi.app or use our contact form.
The non-custodial guarantee: ZapAPI is software, not a bank. Your keys stay with you — so your privacy doesn't depend on our promises alone, but on architecture that makes misuse impossible.